Gateway

Gateway’s DNS filtering tier is an easy win — point resolvers at Cloudflare, get category blocking, malware protection, and logging with essentially no deployment cost. For a small team, it’s a real security improvement for an afternoon of work.

The full story — HTTP inspection, TLS decryption, egress policies — requires the WARP client on every device plus a trusted root certificate, and that’s a genuine operational program, not a toggle. Certificate pinning breakage, per-platform client quirks, and user friction are all part of the deal.

It’s a capable product competing in a serious SASE market. Scored from a smaller-org perspective: the easy parts are great, the deep parts demand more investment than most small teams want to make.